Secure the ICS network

The ICS network itself can be either physically separated or logically segmented from your other corporate networks. A physically separated network is by definition the most secure. The network hardware and all computers and devices connected to it form a single closed network with no physical connection to any other network, so an intruder cannot access the network unless they also have access to the physical location.

In contrast, a logically segmented network is physically connected to your other corporate networks and/or the public internet, but it uses various methods to segregate ICS network traffic from other network traffic. This may include:

• Using a unidirectional gateway

• Implementing a Demilitarized Zone (DMZ) network architecture with firewalls to prevent network traffic from passing directly between the corporate and ICS networks

• Having different authentication mechanisms and credentials for users of the corporate and ICS networks.

• The ICS should also use a network topology that has multiple layers, with the most critical communications occurring in the most secure and reliable layer.